Exposing GCHQ's URL Shortening Service During - An OSINT Analysis 


luri.me 


your free url shortening service! 


welcome to Iurl! 


LURL is a free URL shortening service that allows you to shrink long 
unreadable URLs into a short easy to remember one. Ideal for using on 
Twitter, Myspace or even in your email messages - Lurl will help you get 
links to your friends and family fast! 


All you have to do is put the URL you want to shrink in the box and hit 
the ‘LURL ME’ button, simple as that! 


URL: don't forget the http, https or ftp! 
_ LURL ME! | 


eee eee 
LURL.ME 2009 :: Theme by Neonix 


We've recently decided to come up with a proper analysis on a well known GCHQ URL 
shortening service used for monitoring purposes where the ultimate goal would be to provide 
additional insights into its Internet-connected infrastructure and try to find additional links and 
connections between related campaigns courtesy of the GCHQ largely utilizing WhoisXML API’s 
vast WHOIS and historical WHOIS database on our way to properly map the Internet-connected 
infrastructure of GCHQ’s URL shortening service. 


Sample URL known to have been involved in the campaign: 
hxxp://lurl.me 
Related domains known to have been involved in the campaign include: 


hxxp://mhhiuag.com 


hxxp://Ihngeesp. biz 

hxxp://ciwcesp.com 

hxxp://Ihngeesp.net 

hxxp://ciwcesp. biz 

Sample related responding IPs known to have been involved in the campaign include: 
hxxp://198.105.254.11 

hxxp://37.220.34.116 

hxxp://109.235.48.3 

hxxp://64.74.223.47 


hxxp://198.105.244.11 


Free Voice for Iran 


Tuesday, June 30, 2009 
How Iran is filtering out dissent 


The regime reacted slowly to the 
election protests but its 
censorship of the internet is very 
advanced. Read more.... 

http:/ /lurl.me/Or7076 


Iranian schoolgirls chat online at an internet cafe which is exclusively for females, near 


the city of Karaj. Photograph: Reuters 


Green Graffiti 


Is this the 
way the 
revolution is 
heading? 
Want to see 
more? visit 
http://50 
mbuffalos. 
mono.net/ 
11377/Gr 
een%20Ni 
njas 


Labels: graffiti, green, iran, revolution 
Ahmadinejad calls election defeat for Iran's foes 


TEHRAN (Reuters) - President Mahmoud Ahmadinejad on Tuesday 
hailed his disputed re-election as a victory for the Iranian people 
and a defeat for the Islamic Republic's enemies. Read more... 
http:/ /tinyurl.com/Iqxtao 


Welcome 


Thankyou for visiting my blog. 
Comments and contributions welcome. 


About Me 
BOTT 7: 


View my complete 
profile 


Twitter Updates 


follow me on Twitter 


Search This Blog 
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Iran forum 
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Related malicious MD5s known to have been involved in the campaign include: 


7d20467d045771641678a46db8e8404c01fea19210e2353cbdb3c9914c613214 
82e1a6a7d41403127e1346634e1053091cdf0541076bbfa560aa9d3240f5b6b4 
3570761 cf4dd9748b0f1 e0664f75184bd54a81a5b700ba910229c7 3cad9fad0d 
0a8e5b6406240e7 3c33eccdb809bc4f578c7 760453b1 3f73 1cd1bbab2a48a529 
3021231 7d56ee9090f4e898622422368b0cd510f6a929858992fc3e9 14c258d9 
d67a1e1595e76536e0e6049cc 15195 156e3031401f5d62196727469d068c776c 
865f90614e4c4114238e409c49e523bbd43cfb63785faba/ bb5acfd96a96F4 14 
d545291859e7baa6e4ddf2e5b/7ca22dc0261cd55fa1 57 2dfc664b/7d6028a6eb4 
*7741a4d8507d96495c6662364afb806987d809956280f537 21 8d21a13495c8b 
de6bc26663d8a1 e440e22569dec7b063a2f5af9554d5b6f0930d50393b2161a7 
efa3c9d9de95be6e1b5512651c94881f0197d1778074309a53b04d1 0c553c839 
519b5052664ba60c1 991 ff1c54e12b4fa6956db6bd503b4e5e737ba3a2f507cc 
bf3f0a83b4cc3c20cd91b77d20fa0e6cf80400b8421 50d0ae08bdf915619a639 
Oef845bb58cdc28b007f9f3c3a50 1b6812e4dc9d4c93c3506095724b827ba4ae 
Of8fe346763d5e7275cdbe21 3341 cfa6acb5634c440c29826864f60939fa0a04 
Oe6b5c7db1fca3e30326833a 1 8de4628020edb3d37ee52dc6a15c3b2d651 5e2d 
Oeca62d953f42679cfd0a1 79b28e8badee042467bd5c7747 78e3d6b90257839d 
Odce50bf3841c2b1031eedfbb960fecdb25acb3aee236c4d9fc2af9cb7d7274f 
0e4697282baf8ea318742e3c90913d173251e01d787a45299aad93856d637048 
0d913ea1abae39c50141885ca735f9fa31 OOf96838fee4866303a3b28464f86b 
Odc94e4ac56ce83fffc003d41d204d2f09a681 e06d1382e579cc0a8baf26194e 
11f7cf0f85a5056419b192504cc1a076987 2d46df0e26d499f9f5645d11e0c2a 
1258fa7c7f4d83af6 7a50c8cdd048bc4b536aa93a1576347d5c550787cb1d1d1 
111b4a6c11770d590c7de7064aadfcd246 1 fcf9008fbO02dfba9589bbf02a51 b1 
11a8aec56656445040acfe3e82b649ecc6f6535f28aa98cce644cf74727cd2fe 
Ofddc9468bb86a054f2a8bb38f7ab5e9f210284d5b3d4f0205721838d61 f4 5ff8 
10db08d7a5ba5ca106b6c2f01d0c6f0c9ab94df84a911f80b 17976eda9121323 
0fa487695964ca2edc6eba39a056 73e5e923c6311523e80794461 b6ba3b59f97 
Ofc363a8 1d793221567d999afc0afc833548662d8c6F112ce355d7b395ae8609 
1626087be524f5db3558c0 7bf6559fdf6 1462e757fd3a1e0d124e5b270f1b25b 
16961941d3b510264438ed17591122f97 71 42ff7d8b23cd59cf8e8df6f069374 
14e087cc964c8cd053c87c201 7e2991 8a7476d0fb407613971910a41c60ade4e 
155e87891 e5ed63c9c865695681759db1b81011e404e3eb2334eeb5fee749cc2d 
140faaddf7421a7569f75e77a9a69fe6e1 884a640e3a0d9a788000d94c7 a4 f2f 
145e865065f0e270f0ee373ee01 639c5ccbh9b2a6ec12608a907351d50ccc7bcf 
12da942f1a8c1ca3cffe0714fea74a5a4f39ef53d07 1539732075ae827d294b4 
13393760d81 ad3f99220b727d7451650005ad94c24a838d2dd460bd0aa94707f 
17b7f923455a23b10f1e402fcae3eaal11caf4e23f08b6cc41aa4d9b0e0fcb47 
181cf716070a95cb62b30b1f3e4b35a6502ecfic0005a300fb97e1f5590a08262 
1775f577b4277f526d804 7f9 7e0f8bc37 8f8e 1 db28b1 3f1f5a3584d8648e91d7 
17a5550f5c5c9460f3a3e60768972e215904598bb40b1 be6c3bfde69ff600d82 
1750a052646544a97 85674 1ac16329bb6e9be06be92a1e0d52c9fb7 79fedb422 
17636b67db6b7 e021 8dd3a289ce8069ea0398b1 7 e2aeaf82e5f0e8e4d26b4f47 


1714f12012ac47df14a9993ae01ea5b447ea420d1a2dd2eb9c816516e53d0b72 
171c86f3398797c4ce78ca495e3a3df0d2202af052957 78365 152f32038e43b7 
0631233c4565ba17ea3fa46861b15c64f824c8b1a1833d8d702f29c023a59b5f 
O6c8dedcdd87a88d6e9132c754a81ab4a32768a1 8494 996b6ff8c7e0c4b2e99f 
0544be70518c8e457 73db42b4 7f3c7 111 33ff4dfdb1eca24237b4c870306e89b 
059c84da0358d1 5cba2c240e3cb2c5e5b642cbc78ca7e3756f655182b849993F 
035874a0c6148b8b32ae3d6 1adb7550c4611 fbd440ae26448b68d4aeee1d721b 
05123da2e180bd484665ad3f381 9ec8 1c9de295d6673634ae9bed6ae3 1949fd2 
02de27b3aeeb1 cbcf5c5fd6fe200e27aeb605f57 8ba5d945ba92d30339cbc43a 
02e162cbfcbc7fe1 e152a9fb54c6d5d84c504c5a1d91b34f32cb94f1ed663292 
08c4b73ba535e84f37602cad67 7 1c8df851f4df05620b925dc2d7fd1991e8255 
08e4a26 11f4d8f6550d7b31b4dd845b2d47a10b04d558121ef3ef485f/c3cff6 
07a3b3c098884f05f2b5bcdee4chfed76f099b1fd516d8bfdf72dcd37 aab8f42 
08a5562160ccc057559e307eada7e1 ec7d033f0e8093d449c207ff23b8cc92d3 
07454e84695e1 6c5bc5d5bcdc79a9ebd87dbdfaf138548e466c8 7fb241 fica7f 
07953a9c3c2f26b9ae90efd3874cdcc7013db89768aff1 32781 02c892ae0883a 
06d26f6a95018f0d795a5130c2763ee0921 cf13e2f63780bb62679032df1 95a3 
06e9f87689313b0d1f6a4b11fd479a03ffOf682bc9d 5f8b7ae8f04d6805e2'86 
ObOfdbf39c11fd94bf4c528eb9edc9a7 Offd8 1656031 b8dcb76533679de25c42 
Ob6dfd2c3244e1 22f951 5691 345e5bdd6de4bd4e59ff5e5c455176b84c5a6952 
Qa2aea7c835cc9742a69d7ce28cbe1 f94643e8d028f6f02e583da90ad9b07cc2 
Oaa2d8d0ee1 eedd31b9125ad1abe7d6ed57 1afdab18a4710604435ffd4693028 
09aeb27c23bd19ab3ce4da4a4280a8c/ca3efbafaf6c1 92bd566ca8e08e69145 
0a1215996aeeb80f9d6 7ea8ed9a91398407501b08e126d96b558cd 1 8baQGF8 11 
0952423695181 ab0f3dba230bd9235a8c574fa8051 24df43eb6ceaff88597ff9 
09584e0e8893cc3d5d6b65 1572456658267 4a6d03b76851f87 a7 1a6482fa885 
0d51b348c1 7c3fc82fed0c31628ca12d58f03 1fa827fbb3b6e678b2f6381627e 
Od6bbf32c460427abe18c8f65 169387 aab0d89a7 7e5a1fd75fd1 38c577e2F7db 
0c57587f85116cff70b09a0eab9007f07c128ec26324ece214086306b8 1e73f8 
0d1f1362da7bf2467cd480f8eac4aa54d5722994f4e5e91 07 ef52ce8c02fb6b4 
0c0373fa319127391b6ecee98bf8f93a6b584 8af7 43eb67 9bae8al6 1b1a1c6ed 
0¢350788530f062cda4 1b771 7c20804ffa1c1 8fa7 1662fecf4d1 Obfecf99226f 
Ob9c58ab1c82b5eb22a0a7cd88cdbd4af48eea6c4bab2b27e089587006f2caal 
Obe802bfa99dacf38f2f0a5d4e2f63c89dec1 a23603fbObff350a70ae695ac1 7 
24941 fbf840d5a96e74a3af054504f222eacfb6294d95af1b153c928eaaa9e4a 
2495a5daaff09e93 184f79ccf3 1 089bbec48460d4cf095f65e21e16b8364b231 
23fe21bb3252d0159f64251774b/cff12a6832def68eec1091aa3948597d59e1 
24259d934839e78430cf960e7920c8b4db2f2eac810bbe99Ff77b023c4e1 822f9 
229bb9c524 19237b338d251 2f6bce1 768f87 1596a1 46 111b372416b4152f4a41 
23196b3e165a0107a1cd25a08a538a325faedb8386e4dd251044aea7c19f1 760 
21f32fbfe6b6b48d4c75eb43ee366278d161388a8356997 c3dbd5b3d493ecc3b 
21f7b7696653904d53cd81 73297a4aa04fbc82b795f9b7c7ed6337d19b0e4513 
287f97 768db040fb61 25a 1 fbb1 a9fb356c7cdbd16506aec7 165892986 2b1 2f5f 
28885edcc732ba54e47473ad1d5a79737d3c85f971a0890b372c39c0a3aade49 


277031 bff0b5a20f1 fc7 ea0f89fd55488d9d20e2df56ad0ea9801f7f637be8ee 
2792b82891c1aca7a273c0441bc163c8050cbf9e2f0 9af49bd9061372ce5a997 
26b52d32aff/01e3304da3b183e051f1 9e2ef0a1 31 09cdadfa8e7 2fe1 3761d33 
274787a66399ac2aef39892e79a5700944d 148f8fb8438d51 2f92e90538d7faa 
250854af1 2af0f23f9c32a35c438968abfbf51d18f8cc5749b 11222 1ab2d6823 
26962fb56e7 84fec169ff07f45fe31 79ce3c818fe0f20e3c65dfca72a7e30fd7 
2ae4a16997a14761e34e6acce/6732b184be9db6668b623bc8a3664cfbc5d4a1 
2b1430a123dcbb73682160685b6d08fb95f7 8eab6a9fd 1e34d98752563477111 
2a2fea1ada09dcd39d71b2e3f637ea90ea8c93892b8f0ce7 153602e8379dd8bb 
2ae37 107b75122faf83961288766cc6dd50d32ff1a197f1f2ef897 e69cb8eef8 
295dcc39d374d9944c97c7f9744b9390a4628b02998428ea217701bc8a97b955 
2a099fb7064045dbf22abf1 9c60ff42ee93684d25b51 2acfaf7fec99862abd0b 
28f1cb771de05473b0c1cc2c21f3c437dc50cc6ab3c4c15ceefb21ea6e6b95fa 
28f1 cbfe4715ecdb9a726615d637f7ffb05d0b4db45d 15ea301c0b94f34573ab 
2df1f33bd5f0dd4d59ac5d9d2573f2d9c8014e8bafl 458ab843968b56f8d449d 
2e3c8d9467e7b32845393c9ba7d96ce1 e3c1be823fc75b02b224e6b1fd752480 
2ccfa967de0362aaec80d2dba46ae4ed55c26ae78c61b6d7c03c36e0a43ebfa2 
2dd3b351059cfc22c2302b94fbbb2c2fb2cfb38b2cad 19c2a212624addae5d45 
2c2331c0f1d6f74849886 7c03c2cc6eb788e01 adee7 35cc687a8F7312193dc5b 
2c83adc811 008f38cbd2045888bbf4aa99 1 7591296a7b42b0c099265631a4773 
2bcab13200b8c00cc54686380c27 12db4db30a1c4ac55e6ffd3019982f26c00c 
2c19b49375d1 ae806cbhfcbb5635d3fb09e9fdeef57 beeb 7f35a57a99c/765d4ee 
19a36e7f359d500dae6af0d0ad58215cc77361 7c32bfbec4569baafcb1fde048 
19b310333c5763dc6c0F70941 39880d8e4ba6892ce05af03df4b5f0701f823F7 
194c0d46cb4cf4df668b 1e5d967c1feeaa220a91c34b50d6a7f990db62c77 326 
1997300c18c960d20ebbdfff9ca528074a04c23b9e987 509d 1 2feff93f8ad7e1 
187371 a3fe4f5f51723a22db4c4e46ae39039f0057b7 00b0f7d2466dba53277c 
193c3e6c878d86378fb42a5417e0207fa7806df3ecbe1 39e6f37Ff1 c260fb6d05 
18cc68b9ab946aece3757 94ff1 07c8c3705e21d08e42a61b8a2b86bb1d1303be 
18eaf04a7d6b30967 8604323b838b6361 9f1a067334495559a5c095be07b78f3 
1c192ef68c188a875a40acae635918c45b19127 11dfa0a759401cac5a3cba160 
1cb926a4d7d31395bf0553252af0662f53d548346581 7 7b00535bad0378a3707 
1b7b0a940723546e7bb0907e39367c993fc8cb40442d599b0099f22d26d5f1 71 
1bd23ff2414621 fb6a2dfc5Obdae955fb98e5c670d800ac7257 1 fbcb95229e47 
1b09e3ab9ab650fcc35c8efe565deadd45383276af789a57 2b9986be78c96f5d0 
1b3c0d2a1c63860cba0ae4d01 3b54fe0e9dc22637 1d9ebd27ff1 aeObd8735dfe 
19eefc672a889893096bf1 4c29b9dbe00a2a0010c140f1cf12f46c41215627d8 
1a27d8d41 7f054b3bf90b59721 bb6bfda8319132588e351b211c559559c11690 
1ef2e6c2d4f1b80491cc11a05e565614d031ecc1e4bbb43a4cc07351a08ec3a6 
1f7cO6acde1 c24fad556809b94ae43d7203a4 18d909107dfe6d1fd2cb94c0a91 
1ed1959a783a4d33059c06fa862cfeba6 15c1 fb 7fe592fc72df8257e3bfc27d5 
1ee072a8fc646350a066533684234f3c0495a1 9a57365f3ce77b97e2adeeba39 
1d8e826a4dd296aa348e5271c57fcdca27e81 cf286ac4a73545698bi4e822572 
1e808dd42f93f0d06a8c7771d1eddc1 06cf77d1001cf86d091669434e24f0625 


1d16755023e723052bfb4 7983aec7 1bcdObf72bd2422f34181d864b6d91c07b4 
1d3585deaadc056fc731b510c703c97751f5ccc748a3a58abe87d9eaNdfd4 1 2b 
21c903e79f5892f8e7e3975051 fd3948688f488a04ddb48b8be4bf960bee1cca 
21cf732dd3a598943a94824c6121d876cc5e707 09ff5f333022eb0fa1 bcOa05a 
21081438ce58a2 1d5d88b6d8af7 982732 1cc8ef5b10259fb70576f47c0f4 7a3d 
21c2fbdc9b653740aed6c91169a6797f31 b8f0O0d8cd8e98f509f0e8e2c36bd39 
2031b49e54b4cc4075f67d51b467b3ba6bcf6f5cff9edb7 cfc007 7e989490fcc 
208bb6356e664c44d1699b4363cac52f1 d10cc229757fbc1eb1 72f895de81 5db 
1f8db2036fee4a9464 1 bf2bb47 8aa7c4224b04f8b790e307 7a6105036ff0919e 
1fdb115762b1ec87dff71244fc51e74cb4954ec0cd81e2e9c94e56651 5fb992c 
3dd4bfa803735eec07 effb74721a30980ed02bccec881d782a46c63e/7bee168b 
3e0bd8535575f51dc788111893abfb 7633dcb6d7 7deaba649bf656c7ac0008a9 
3cf5a9ad3f9c3ce316a74345e424eb7387bd63c572a206bd7f7bb3c34ca9507a 
3dbfe994f182307ebe3a43b89210e285d7f44e7dde429823b4e39849bf37 1 bee 
3bcaedca97eecde6/c66a52483e 194087 e1662f74c3d66108c6de9910b455a46 
3c085483f5af29a40a92fdfe4dd6eaa7cdf1b8dca413014de07c213e95870aa3 
3a8e0aeb3 1837658d2a132149499955855a574d7f7ba497f2259a93c5e61 fb68 
3b6 1bdcc21a9eae293dcd148ecebc80337edb2f4f5ed3abd40f207 796f867235 
42e8c6bbd0e0652df9d8034edbf4cc9c2d6ab371aa2791b04b288d0bba8be 781 
431334046d6e9c6f00a567 df354fb609c7853dce7d63e901fb18d19384a2838c 
421279a2dd1 2fd1842a204feccd0c089cb00b60e5c1cf7ac3024e42e0bb2cd26 
4224a28e509c68 1433e267a01b1a4121c17d97e5f6c49d 1a037017dc25033f20 
A0fe6360cd29995fc7302be9c6faadb1 b8f907 bb46f5c39f44 1 72d4f6f7a787c 
4123b6081 98f4a72964facc3beb85c881 a8b00f5733f506a21977e73f3cdaicd 
3efa6ecc2a22cbhd7258ab6b6435ac4863588a54ab3e809041 5ad728b9737ddb5 
3f3814e684379932b6c31b71756c76064ee2bde6a75f483b6cf3f90dc1 8bde73 
453dfd2cb6c95c1916687960063a0520ace6a4b812973fe39efe9dc465bce3d3 
4631f6712049aaae6858F1091 b97129fb2964f893969e6f8c27899df0O9bb7bb0 
441073890b4c6afcb1c45d759175dc4e25064ebf67ce79120298a9713b07b6aa 
45121c589b0866ced58d36e4fc34d9dce5bed57d7483e67a2b7230d045bf8fd9 
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We'll continue monitoring the campaign and will post updates as soon as new developments 
take place. 


